What’s Vulnerable › Vulnerabilities

CVE-2019-3888

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-12 · updated 2026-06-17
• Weakness: CWE-532

Description

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• RedHat Jboss Data Grid: all versions
• RedHat Openshift Application Runtimes: all versions
• Red Hat undertow: before 2.0.21 — fixed in 2.0.21
• RedHat Virtualization: 4.0
• RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Red Hat undertow 2.0.21. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/108739
• https://access.redhat.com/errata/RHSA-2019:2439
• https://access.redhat.com/errata/RHSA-2019:2998
• https://access.redhat.com/errata/RHSA-2020:0727
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888
• https://security.netapp.com/advisory/ntap-20220210-0019/
• http://www.securityfocus.com/bid/108739
• https://access.redhat.com/errata/RHSA-2019:2439
• https://access.redhat.com/errata/RHSA-2019:2998
• https://access.redhat.com/errata/RHSA-2020:0727
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888
• https://security.netapp.com/advisory/ntap-20220210-0019/

Get alerted when CVE-2019-3888 or the next vulnerability affects your stack